Fix off-by-one error in AstTyper, part 2.

test/mjsunit/regress/regress-param-local-type.js

Index: test/mjsunit/regress/regress-param-local-type.js
diff --git a/test/mjsunit/regress/regress-param-local-type.js b/test/mjsunit/regress/regress-param-local-type.js
index ed688a90f33ca5f0449a013f16a10ec990c2df3d..bf260900898923a5fe2471aed82eb9ce5f896bf2 100644
--- a/test/mjsunit/regress/regress-param-local-type.js
+++ b/test/mjsunit/regress/regress-param-local-type.js
@@ -42,3 +42,17 @@ f(1);
 %OptimizeFunctionOnNextCall(f);
 f(1);
 assertOptimized(f);
+
+
+function g() {  // 0th parameter (receiver) is tagged.
+  var s = '';   // First local has string type.
+  var n = 0;
+  var i = 1;
+  n = i + this;
+}
+
+g.call(1);
+g.call(1);
+%OptimizeFunctionOnNextCall(g);
+g.call(1);
+assertOptimized(g);